CVE-2021-35030

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.1%
top 69.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
Zyxel Gs1900-10hp FirmwareZyxel Gs1900-16 FirmwareZyxel Gs1900-24 Firmware+9 more
Timeline
PublishedJul 26
Latest updateMay 24

Description

A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize packet contents and could allow an authenticated, local user to perform a cross-site scripting (XSS) attack via a crafted LLDP packet.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:LExploitability: 0.9 | Impact: 2.5

Affected Packages13 packages

Patches

Patch: www.zyxel.com ↗Patch: www.zyxel.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g78g-pgq7-f6cr: A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2↗2022-05-24
▶
CVEList
CVE-2021-35030: A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2↗2021-07-26
▶